integrate security audit for commits and before releasing

threefoldtech / tfgrid-sdk-ts

Apache License 2.0

4 stars 8 forks source link

integrate security audit for commits and before releasing #2810

Closed xmonader closed 2 months ago

xmonader commented 4 months ago

integrate security audit for commits and before releasing to avoid security vulnerabilities, maybe can be in the precommit to run npm audit or as part of the PR checks or any other reasonable option

zaelgohary commented 4 months ago

Work completed:

Add audit workflow, When the action is executed, it runs yarn audit command in root. The exit codes of the commands are compared and if it is greater than 7 (only high severity as of now), the action will try to fetch the open issues in the repo with the label audit. The label is mandatory to prevent from creating duplicate issues. If there are no open issues with the given label in open state, the action will try to create a Github Issue with the details provided.

khaledyoussef24 commented 2 months ago

the work flow is added and running. even duplicate issue creation is added to avoid duplication of issues issue #2978 is created to solve the missing Security Vulnerability